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Present user(s) with questions relating to 
business areas and/or categories 



Solicit responses from user(s) for each 
question presented 
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Prioritize the business areas and/or 
categories based on total risl< scores 



Figure 1 
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Detection index is determined based on 
user responses, the number of questions, 
and the number of users 
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Occurrence index is determined based on 
the potential consequences of non- 
compliance 
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Severity risk index is determined based 
on the potential consequences of non- 
compliance 
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Total Risk Score is determined for each 
category for which qestlons are presented 



Figure 2 
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Figure 3 
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Server Station 330 



Administration Module 400 



Query Module 410 



Prioritization Module 420 



Figure 4 



